Cryptography and Evidence

UCAM-CL-TR-780 Technical Report ISSN 1476-2986 Number 780 Computer Laboratory Cryptography and evidence Michael Roe May 2010 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2010 Michael Roe This technical report is based on a dissertation submitted April 1997 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Clare College. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/techreports/ ISSN 1476-2986 Summary The invention of public-key cryptography led to the notion that cryptographically protected mes- sages could be used as evidence to convince an impartial adjudicator that a disputed event had in fact occurred. Information stored in a computer is easily modified, and so records can be falsified or retrospectively modified. Cryptographic protection prevents modification, and it is hoped that this will make cryptographically protected data acceptable as evidence. This usage of cryptography to render an event undeniable has become known as non-repudiation. This dissertation is an enquiry into the fundamental limitations of this application of cryptography, and the disadvan- tages of the techniques which are currently in use. In the course of this investigation I consider the converse problem, of ensuring that an instance of communication between computer systems leaves behind no unequivocal evidence of its having taken place. Features of communications protocols that were seen as defects from the standpoint of non-repudiation can be seen as benefits from the standpoint of this converse problem, which I call “plausible deniability”. 3 Acknowledgements I would like to thank Peter Kirstein and Ben Bacarisse for managing the research projects which caused me to become interested in this area; Steve Kent for many interesting discussions about the problems of key certification; Russ Housley for suggesting the term “plausible deniability”; Roger Needham for being my supervisor; and Bruce Christianson for his advice on how to write a dissertation. 4 To my grandfather, George A. Lear 5 Contents 1 Introduction 9 1.1 Narratives of conflict . 9 1.2 Non-repudiation . 10 1.3 Plausible deniability . 11 1.4 Focus ........................................... 11 2 Background 13 2.1 Notation........................................ 13 2.2 The integrity and confidentiality services . 14 2.2.1 Separation between integrity and confidentiality . 14 2.2.2 Connections between integrity and confidentiality . 16 2.2.3 Someattacks ................................... 16 2.3 Kerberos and the Needham-Schroeder protocol . 18 2.4 Digitalsignatures.................................. 19 2.5 PGP............................................ 20 2.5.1 The motivation for PGP . 20 2.5.2 Reasons for the success of PGP . 20 2.5.3 LimitationsofPGP ............................... 21 2.6 X.509 ........................................... 23 2.6.1 WhatX.509doesn’tsay ............................. 23 2.6.2 X.509 and non-repudiation . 24 2.6.3 Certification authorities . 24 2.6.4 Certification paths . 24 2.6.5 Revocationlists................................. 25 2.6.6 X.509versions .................................. 26 2.7 Internet Privacy Enhanced Mail . 27 2.7.1 Revocationlists................................. 27 2.8 NIST/MITRE Public Key Initiative . 28 6 2.9 The public key infrastructure . 28 2.10 ISO non-repudiation framework . 28 3 Public key cryptography 30 3.1 Convert from integrity only to integrity plus confidentiality . ....... 30 3.2 Verifier needs no secrets . 31 3.3 One-to-many authentication . 32 3.4 Forwardable authentication . 33 3.5 Non-repudiation . 34 3.6 Scalable key distribution . 35 3.7 Promiscuous key management . 36 4 The non-repudiation service 37 4.1 Evidence is not the same as mathematical proof . 38 4.2 The parties to the dispute are not necessarily participants in the disputed event . 39 4.3 It is not necessarily the case that one party is telling the truth and the other is lying 39 4.4 There does not need to be a “judge” . 39 4.5 Non-repudiation mechanisms can go wrong . 40 4.6 Justification and obligation . 41 4.7 The OSI non-repudiation services . 42 5 Certificates, certification paths and revocation 44 5.1 Certification paths . 44 5.1.1 Analysis of authentication properties . 44 5.1.2 Timeliness..................................... 45 5.1.3 Jurisdiction.................................... 46 5.1.4 Why non-repudiation is different . 47 5.1.5 Completing the paper trail . 48 5.2 Certificate revocation . 49 5.2.1 The authentication perspective . 49 5.2.2 The non-repudiation perspective . 49 5.2.3 Some improved mechanisms . 50 5.3 The moral of this chapter . 53 6 The plausible deniability service 54 6.1 The service/threat duality . 54 6.1.1 Distinction between a security problem and a reliability problem . 54 6.1.2 Whose goals should be supported? . 55 6.2 Plausible deniability . 55 7 6.3 The plausible deniability paradox . 56 6.4 Motivation ...................................... 56 6.4.1 Fairvoting .................................... 56 6.4.2 Personalprivacy ................................. 57 6.4.3 Protection of intellectual property . 58 6.4.4 Limitation of liability . 58 6.5 Someprotocols ...................................... 58 6.5.1 One-time pads . 58 6.5.2 Diffie-Hellman .................................. 59 6.5.3 Zero-knowledge protocols . 60 7 The lifecycle of a private key 61 7.1 Theenemywithin .................................... 61 7.2 Generation and installation of key pairs . 62 7.2.1 CA generates private key . 63 7.2.2 User generates private key . 63 7.3 Useofprivatekeys .................................. 64 7.3.1 Confidentiality of private keys . 64 7.3.2 Protection against malicious programs . 64 7.3.3 Independence from the implementation . 65 7.4 Destruction of private keys . 65 7.5 Transportofprivatekeys ............................. 66 7.6 Key generation revisited . 67 8 Conclusions 69 8 Chapter 1 Introduction 1.1 Narratives of conflict The study of computer security, by its very nature, is a study of conflict. The notion of a computer security mechanism presupposes the possibility of a conflict of goals between people or organisa- tions, and the possibility that part of this conflict will take place within a computer system. Some of these conflicts can be described in terms of “insiders” and “outsiders”. From the perspective of the “insiders”, the “outsiders” have no right or legitimate reason to access the computer system, and the security mechanisms built by the insiders are directed towards keeping the “outsiders” outside. When systems are described in this way, the author of the description is usually sympathetic towards the cause of the insiders, and intends that the readers will feel the same way. The computer security genre has conventions for providing the reader with hints as to where their sympathies should lie (rather like the good guys wearing white hats and the bad guys wearing black hats in Westerns). Security protocols are often described in terms of the imaginary protagonists “Alice” and “Bob”, together with as many of their friends, family, and foes as are needed to tell the story [30, chapter 2]. It is the convention that the reader should feel sympathy for Alice and Bob, while regarding the protagonists with names later in the alphabet with some suspicion. A typical account of a security protocol can be summarised as follows: Alice and Bob live in a lawless and dangerous place, and are threatened by a succession of natural hazards and incursions by the outsiders. Alice and Bob employ a variety of ingenious technical means to overcome these threats, and live happily ever after. This dissertation is concerned with conflicts which cannot easily be narrated in these terms. For example, there can be conflicts between different users of a computer system; between the provider and the users of a service; and between the authors of a piece of software and its users. These conflicts cannot be viewed as insider/outsider conflicts; both of the conflicting parties have some form of legitimate access to the system in question. In much of the technical discussion which will follow, there will be no a priori assumptions about the identity of the guilty party. It might be Alice; it might be Bob; it might be both of them colluding together or someone else entirely. In this state of mind, even security protocols which could have been modelled in insider/outsider terms are seen in a new light. Although we can free ourselves of any prejudice with respect to the imaginary characters “Alice” 9 and “Bob”, the act of analysis and inquiry is still not neutral. In seeking to understand the situation, the reader and writer are implicitly taking sides in the conflict. Some participants stand to gain by the situation being better understood, while others stand to lose from this. However, when the true state of affairs is unclear, it can be unclear who is benefitting from the lack of clarity. 1.2 Non-repudiation It is often the case that people who do not entirely trust each other wish to participate in a joint activity which they see as being mutually beneficial. In such a situation, each participant would like to have some form of protection against possible malicious actions by the other participants. Human society has developed many such protection mechanisms, for example, the law of contract, and the law of tort. This dissertation is not about new or alternative forms of human social organisation or dispute resolution. Rather, it is about some specific new problems which have been caused by the use of computer networks as intermediaries in interactions between people. Cryptography can be used to provide several different forms of protection in the electronic world. Together, these new forms of protection go some way towards making computer-mediated interactions as safe as non-computerised ones. In this dissertation I will be examining a particular type of protection, namely the ability to form binding agreements between individuals and to have fair arbitration of disputes concerning those agreements.

Load more